For the processing of guest and supplier information for the Madklubben Group

1. Data Controller
The Madklubben Group is the data controller.

Contact Information:
Solbjergvej 10, 2000 Frederiksberg
Phone: 33 32 32 34
Email: madklubben@madklubben.dk

The Madklubben Group consists of the following companies:
Madklubben ApS
Madklubben Bistro ApS
Madklubben Grill ApS
Madklubben Vesterbro ApS
Madklubben Frederiksberg ApS
Madklubben Aarhus ApS
Madklubben Odens ApS
Madklubben Østerbro ApS
Madklubben Regnbuepladsen ApS
Madklubben Nørrebro ApS
Madklubben Åboulevarden ApS
Madklubben Lyngby ApS
Madklubben Esbjerg ApS
Madklubben Catering ApS
Bistro Royal ApS
Tonys ApS
Bazaar ApS
Hanzo Aarhus ApS
Frankies Pizza ApS
Frankies Pizza Frederiksberg ApS
More Frankies Pizza ApS
Even More Frankies Pizza ApS
Roberta ApS
Hanzo København ApS
La Bodega ApS
Madklubben HOC ApS
Lupo Aarhus ApS
Frank Gruppen ApS
Madklubben Grill Odense ApS
Frankies Pizza Odense ApS

Hereinafter, all companies will be collectively referred to as the Madklubben Group.

The Madklubben Group handles all personal information in accordance with applicable data protection laws. The Madklubben Group enters into agreements with guests and suppliers for the provision, purchase, and sale of various services and products.

When a guest orders and purchases one or more of the Madklubben Group's services and provides their personal information, they simultaneously consent to the processing of their personal information by the Madklubben Group. The same applies to any personal information provided by suppliers to the Madklubben Group in connection with the submission of bids or entering into agreements with the Madklubben Group.

2. Collection of Personal Information by the Madklubben Group

The Madklubben Group collects personal information in the following ways:

When a guest, or a representative of a guest, makes a table reservation, requests a quote for an event or other service, or when a supplier submits offers or sells products or services to the Madklubben Group.
Through browser cookies on our websites.
When purchasing gift cards via the Madklubben Group's website.
From social media.
From signing up for newsletters.
When suppliers enter into agreements with the Madklubben Group or submit offers to the Madklubben Group.

The collection and processing of personal information, as mentioned above, will always be in accordance with applicable data protection laws.

3. Information Collected by the Madklubben Group

The Madklubben Group collects the following personal information:

Name, address, phone number, email address, date of birth, and other general non-sensitive information.
Payment card information – when purchasing gift cards and tickets for events and gatherings.
Demographic information.
Purchase history.
Information from customer surveys and guest feedback.
Information from any contests held.
Information from the Madklubben Group's social media and other digital platforms owned by the Madklubben Group.
Browser information.
Information about the guest's company and relevant contacts.
Information about suppliers' companies and information about relevant contacts and key personnel, including key accounts.

A guest/supplier may voluntarily and at their own discretion provide additional personal information to the Madklubben Group if they believe it may be relevant to the Madklubben Group's service to the guest/supplier, or if the individual believes it should be provided for security reasons. This may include information about:

Disabilities
Allergies
Specific dietary preferences
Other health or medical information

If a guest/supplier voluntarily and at their own discretion chooses to provide such information, the Madklubben Group interprets this as consent to register and store these sensitive details about the individual.

In addition to the information that the Madklubben Group receives directly from guests/suppliers, the Madklubben Group may in some cases collect or process additional information that the Madklubben Group has received from third parties, such as an intermediary or an employee of the company where the registered person is employed. In such cases, the third party in question is obliged to inform the relevant guests/suppliers about the Madklubben Group's terms and conditions, as well as the Madklubben Group's privacy policy. It is also the responsibility of the third party concerned to ensure that there is the necessary legal basis for the collection and processing of the relevant information, including obtaining any necessary consent for the processing of any sensitive information. For reservations and orders of services and products, the Madklubben Group retains the information provided by the guest/supplier for up to 2 years, after which the information is deleted.

4. Payment with Payment Cards

The Madklubben Group uses DIBS (Nets) for processing payments with payment and credit cards in our restaurants. The Madklubben Group uses DIBS and QuickPay for handling online purchases on our webshop, and we do not retain information about payment methods, including card numbers, bank account numbers, or the like. DIBS, QuickPay, and the Madklubben Group are approved and certified by the Danish Payment System (www.pbs.dk). For orders and reservations, the Madklubben Group retains the information provided by the guest/supplier for up to 2 years, after which the information is deleted. Exceptions to this are information about payment and credit cards, which are deleted after the current year + 5 years.

In addition to handling the order, the provided information is only used if a guest/supplier, for example, contacts us with questions, or if there are errors in the order/payment.

5. Purpose of Collection and Processing

The Madklubben Group only collects personal information that is necessary to fulfill agreements made with guests/suppliers regarding the delivery of services, such as a table reservation at one of the Madklubben Group's restaurants or the purchase/sale of products or services. The specific content and nature of each agreement determine which personal information the Madklubben Group collects and processes, as well as the purpose of the collection. The purpose of collecting and processing personal information will primarily be:

Processing guests' reservations and purchases of the Madklubben Group's services.
Processing suppliers' offers for, as well as sales of products and services.
Contacting the guest before, during, and after their visit.
Sending (opening) offers in connection with signing up for waiting lists for test dinners.
Fulfilling the guest's request for an offer on or purchase of services.
Improving and developing the Madklubben Group's services.
Customizing the Madklubben Group's marketing and other communication.
Analyzing guest/supplier behavior and marketing towards them.
Administering guests'/suppliers' relationship with the Madklubben Group.

6. Legal Basis for Processing

The Madklubben Group will most often process personal information because it is necessary to fulfill an agreement with the Madklubben Group in which a guest or supplier is a party. This can, for example, occur in connection with hosting an event, meeting, or handling and fulfilling cooperation and supplier agreements.

If a guest, in connection with a visit to the Madklubben Group, provides specific personal preferences or considerations, including health-related information, disabilities, religious beliefs, or the like, the Madklubben Group will only use this information to ensure that it is taken into account.

In some situations, the Madklubben Group receives personal information from a third party, such as a travel agency, an agent, or the like, particularly in connection with group bookings. When this happens, the relevant third party is required to inform the respective guests/suppliers about the Madklubben Group's terms and conditions, as well as the content of this privacy policy.

7. Rights of the Data Subject

According to the rules of the General Data Protection Regulation (GDPR), data subjects (guests/suppliers) have the following rights:

A data subject has the right at any time to gain insight into what personal information the Madklubben Group processes about them.
A data subject has the right at any time to have their personal information corrected and updated by the Madklubben Group.
A data subject has the right at any time to have their personal information deleted by the Madklubben Group. If a data subject requests deletion, all information that the Madklubben Group is not legally required to keep will be deleted. Deletion of a data subject's information may in some cases mean that the Madklubben Group cannot fulfill any agreements entered into or provide certain services to the data subject. If some of the information that the Madklubben Group has about a data subject has been provided based on the data subject's consent, the data subject has the right at any time to withdraw that consent, meaning that the information will be deleted or no longer used by the Madklubben Group.

However, the possibility of requesting deletion, etc., may be limited to protect the privacy of other individuals, business secrets, and intellectual property rights.

A data subject may at any time request from the Madklubben Group an overview of and a copy of the personal information about the data subject that the Madklubben Group possesses. A written request for this purpose must be signed by the data subject and include their name, address, phone number, and email address.

A data subject can also contact the Madklubben Group if the data subject believes that their personal data is being processed in violation of the law or in violation of other legal obligations, such as the agreement/contract that the data subject has with the Madklubben Group. A written request should be sent to the Madklubben Group, see contact details above under section 1. The Madklubben Group will, as far as possible, within 1 month of receiving the data subject's written request, send it to the data subject's postal address.

If a data subject requests correction and/or deletion of their personal information, the Madklubben Group will assess whether the conditions for the request are met, and the Madklubben Group will then implement changes or deletions as quickly as possible. The data subject will receive a response to the request within 1 month of receipt. The Madklubben Group reserves the right to reject requests that are characterized as harassing repetition, that require disproportionate technical measures, that affect the protection of other individuals' personal information, or in other situations where it would be disproportionately resource-intensive or very complicated to fulfill the request.

8. Security and Sharing of Personal Information

The Madklubben Group protects the personal information of the data subject and has established guidelines to protect the data subject's personal information from unauthorized disclosure and from unauthorized access or knowledge by unauthorized parties.

Only individuals employed by the Madklubben Group who, by virtue of their job function, need the data subject's personal information have access to it. The Madklubben Group continuously monitors for unauthorized access to the data subject's personal information.

In the event of a security breach where there is a high risk of misuse of the data subject's personal information, the Madklubben Group will notify the data subject of the security breach as soon as possible. The Madklubben Group's security procedures are continually reviewed and updated in relation to technological developments. The Madklubben Group uses a number of external providers of IT services, IT systems, payment solutions, etc. The Madklubben Group regularly enters into data processing agreements with all suppliers, thereby ensuring that external data processors also maintain a necessary and high level of protection regarding the data subject's personal information.

The Madklubben Group shares the data subject's personal information internally within the group among Madklubben's restaurants. The purpose is to provide the guest with the best service, regardless of which department in the Madklubben Group the guest uses. The Madklubben Group deletes your personal information when the Madklubben Group's legal obligation ceases or when the purpose of collecting and processing the information is no longer present. As a general rule, financial data is stored for 5 years and other data for 2 years from the last visit.

9. Cookies

The Madklubben Group uses cookies. Further information about the Madklubben Group's cookie policy can be obtained on our website.

10. Complaints

Complaints about the Madklubben Group's processing of personal information can be made to the Danish Data Protection Agency, Borgergade 28, 5th floor, 1300 Copenhagen K., phone 33193200, email dt@datatilsynet.dk.

11. Update

This document will be regularly updated and at least once a year. The document was last updated on September 9, 2023.

CSR